40388c52481d0c13f9da28fe07d12f8cd1676a07f89bea584e45018fb6d2c87a

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 09:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a4dbafa559f2214faeab1d20328955d8_JaffaCakes118.html
Size

213KB
MD5

a4dbafa559f2214faeab1d20328955d8
SHA1

7bcdaa78bdbc1161c94b3aabf9b8e6f07a5e0e46
SHA256

40388c52481d0c13f9da28fe07d12f8cd1676a07f89bea584e45018fb6d2c87a
SHA512

88a4d6ad6e41d2d1f23c8c66d688c59a72326aa968c0de44f64dda878957cef14e1aee501a7ae44a57e0dc842c8d3fe86437701d40d4e85a17b2c8b0c65fc06b
SSDEEP

3072:S1yyVllOy/pyfkMY+BES09JXAnyrZalI+YQ:S15tMsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
1800	msedge.exe
1800	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2416	msedge.exe
2416	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2772	2416	msedge.exe	86
PID 2416 wrote to memory of 2772	2416	msedge.exe	86
PID 2416 wrote to memory of 660	2416	msedge.exe	87
PID 2416 wrote to memory of 660	2416	msedge.exe	87
PID 2416 wrote to memory of 660	2416	msedge.exe	87
PID 2416 wrote to memory of 660	2416	msedge.exe	87
PID 2416 wrote to memory of 660	2416	msedge.exe	87
PID 2416 wrote to memory of 660	2416	msedge.exe	87
PID 2416 wrote to memory of 660	2416	msedge.exe	87
PID 2416 wrote to memory of 660	2416	msedge.exe	87
PID 2416 wrote to memory of 660	2416	msedge.exe	87
PID 2416 wrote to memory of 660	2416	msedge.exe	87
PID 2416 wrote to memory of 660	2416	msedge.exe	87
PID 2416 wrote to memory of 660	2416	msedge.exe	87
PID 2416 wrote to memory of 660	2416	msedge.exe	87
PID 2416 wrote to memory of 660	2416	msedge.exe	87
PID 2416 wrote to memory of 660	2416	msedge.exe	87
PID 2416 wrote to memory of 660	2416	msedge.exe	87
PID 2416 wrote to memory of 660	2416	msedge.exe	87
PID 2416 wrote to memory of 660	2416	msedge.exe	87
PID 2416 wrote to memory of 660	2416	msedge.exe	87
PID 2416 wrote to memory of 660	2416	msedge.exe	87
PID 2416 wrote to memory of 660	2416	msedge.exe	87
PID 2416 wrote to memory of 660	2416	msedge.exe	87
PID 2416 wrote to memory of 660	2416	msedge.exe	87
PID 2416 wrote to memory of 660	2416	msedge.exe	87
PID 2416 wrote to memory of 660	2416	msedge.exe	87
PID 2416 wrote to memory of 660	2416	msedge.exe	87
PID 2416 wrote to memory of 660	2416	msedge.exe	87
PID 2416 wrote to memory of 660	2416	msedge.exe	87
PID 2416 wrote to memory of 660	2416	msedge.exe	87
PID 2416 wrote to memory of 660	2416	msedge.exe	87
PID 2416 wrote to memory of 660	2416	msedge.exe	87
PID 2416 wrote to memory of 660	2416	msedge.exe	87
PID 2416 wrote to memory of 660	2416	msedge.exe	87
PID 2416 wrote to memory of 660	2416	msedge.exe	87
PID 2416 wrote to memory of 660	2416	msedge.exe	87
PID 2416 wrote to memory of 660	2416	msedge.exe	87
PID 2416 wrote to memory of 660	2416	msedge.exe	87
PID 2416 wrote to memory of 660	2416	msedge.exe	87
PID 2416 wrote to memory of 660	2416	msedge.exe	87
PID 2416 wrote to memory of 660	2416	msedge.exe	87
PID 2416 wrote to memory of 1800	2416	msedge.exe	88
PID 2416 wrote to memory of 1800	2416	msedge.exe	88
PID 2416 wrote to memory of 1940	2416	msedge.exe	89
PID 2416 wrote to memory of 1940	2416	msedge.exe	89
PID 2416 wrote to memory of 1940	2416	msedge.exe	89
PID 2416 wrote to memory of 1940	2416	msedge.exe	89
PID 2416 wrote to memory of 1940	2416	msedge.exe	89
PID 2416 wrote to memory of 1940	2416	msedge.exe	89
PID 2416 wrote to memory of 1940	2416	msedge.exe	89
PID 2416 wrote to memory of 1940	2416	msedge.exe	89
PID 2416 wrote to memory of 1940	2416	msedge.exe	89
PID 2416 wrote to memory of 1940	2416	msedge.exe	89
PID 2416 wrote to memory of 1940	2416	msedge.exe	89
PID 2416 wrote to memory of 1940	2416	msedge.exe	89
PID 2416 wrote to memory of 1940	2416	msedge.exe	89
PID 2416 wrote to memory of 1940	2416	msedge.exe	89
PID 2416 wrote to memory of 1940	2416	msedge.exe	89
PID 2416 wrote to memory of 1940	2416	msedge.exe	89
PID 2416 wrote to memory of 1940	2416	msedge.exe	89
PID 2416 wrote to memory of 1940	2416	msedge.exe	89
PID 2416 wrote to memory of 1940	2416	msedge.exe	89
PID 2416 wrote to memory of 1940	2416	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a4dbafa559f2214faeab1d20328955d8_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff82b7446f8,0x7ff82b744708,0x7ff82b744718
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,10292888684789641654,15107842999555794470,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,10292888684789641654,15107842999555794470,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,10292888684789641654,15107842999555794470,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,10292888684789641654,15107842999555794470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,10292888684789641654,15107842999555794470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,10292888684789641654,15107842999555794470,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3156 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3444

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2904

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c5abc082d9d9307e797b7e89a2f755f4

SHA1
54c442690a8727f1d3453b6452198d3ec4ec13df

SHA256
a055d69c6aba59e97e632d118b7960a5fdfbe35cfdfaa0de14f194fc6f874716

SHA512
ad765cddbf89472988de5356db5e0ee254ca3475491c6034fba1897c373702ab7cfa4bd21662ab862eebb48a757c3eb86b1f8ed58629751f71863822a59cd26c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b4a74bc775caf3de7fc9cde3c30ce482

SHA1
c6ed3161390e5493f71182a6cb98d51c9063775d

SHA256
dfad4e020a946f85523604816a0a9781091ee4669c870db2cabab027f8b6f280

SHA512
55578e254444a645f455ea38480c9e02599ebf9522c32aca50ff37aad33976db30e663d35ebe31ff0ecafb4007362261716f756b3a0d67ac3937ca62ff10e25f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6bb08a581f14ce0fe1c5f28841b8321e

SHA1
b097ed0f24f4df744364c660e76cb7dbe1d74631

SHA256
e85d0e6b74a0b4cd37c4af9c01fec74b6542a8801cf8b9e29c304911224ef912

SHA512
eba20a2ca0087ca7c4f5284302c617b902e7f8460586558dd4cfb13cfd9badbd9a8321f5eba360e3d593f4b9c464349cbcbceeee45106655323d735fc9c5065b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0ac43e8bee32b0892176b13cab4f7e9a

SHA1
3e72354a08945617ae767e19e8a1e59a2f55818c

SHA256
8cf5a900233b3bf4d8b31df7d647f450caa71e69eec64c86ecb73ca5d72d47cb

SHA512
d6e807d33caa4b85a51abf9bd4643ae02f1ec7ee361c8b40f7943d42f97583bcf0da6346f65dc128f954d4f6daaf5bc00721f7fc7d20f567f26e0cc49aab2ed4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
cb04f1bb3fe141bbe747a54847a9fd09

SHA1
7d95dbe2e2f78afaa5e0470275d1ebd9886ffe8c

SHA256
7b5c763fb5ceb8d60e60cf459546aef1fb174b1668c84a088b6bebcd42fc9d71

SHA512
50715c8015cd60080c7996b74f092e5b3a73c0168d3b01fe861d293e49aac2a0b9db91a31779286b69b72800e22f40dcadc18432b33474c91894012325d6b8cc

Download Submit